The perimeter model is simple: authenticate once at the edge, then trust everything inside. It made sense when users sat in buildings and applications lived in a data center.
A teacher at home on a personal iPad, reaching a SaaS gradebook and an on-premises file share, breaks that model in two places: there is no meaningful inside, and the device is not yours.
What zero trust actually changes
| Perimeter model | Zero trust model |
|---|---|
| Network location grants access | Identity, device, and context grant access |
| One tunnel to everything | One policy per application |
| VPN concentrator | Identity-aware proxy |
| Trust after login | Continuous evaluation |
The unit of access changes from "the network" to "the application." That is the entire architectural shift, and everything else follows from it.
The components
| Component | Job | Example |
|---|---|---|
| Identity provider | Who you are, with MFA | Google Workspace, Entra ID |
| Device posture | Is the device managed and patched | MDM enrollment, disk encryption |
| Policy engine | May this subject reach this app | Conditional access rules |
| Access proxy | Enforces the decision per request | Google IAP, Cloudflare Access, Entra Private Access |
Notice what is missing: a tunnel that grants broad reach. The proxy sits in front of each application and decides every request.
Zero trust is not a product
Buying an access proxy does not make a network zero trust. The work is inventorying applications, classifying them, and moving each one behind an identity check — which is a multi-year program in a district, not a purchase order.
Where a VPN still wins
Honesty matters here, because the marketing does not have it:
- Legacy applications that assume a flat network and cannot do SSO. They need a tunnel or a re-platform.
- Management planes. Switch and controller access belongs on a VPN or a jump host, not on the public internet behind a proxy.
- Site-to-site links. A campus is not a user; IPsec or a private circuit is still correct.
- Operational technology. HVAC, cameras, and door controllers rarely speak modern identity, and segmenting plus tunneling is the pragmatic answer.
The realistic architecture is hybrid: identity-aware access for user-facing apps, tunnels for infrastructure and legacy, and segmentation for everything else.
A migration that works
- Inventory applications. Every internal service, its users, and whether it supports SSO.
- Classify. SaaS-ready, proxy-ready, legacy, or infrastructure.
- Move the easy ones first. Web apps with SSO go behind the proxy; measure support tickets.
- Narrow the VPN. As apps move, remove their routes from the tunnel. The VPN becomes smaller every quarter instead of growing.
- Add device posture to the policy engine, starting with staff laptops.
- Keep a break-glass path for the day the identity provider is down.
Step 6 is the one people forget: if every application depends on the IdP being reachable, an IdP outage is a total outage. Keep an emergency access path, documented and tested.
Worked example: the file share
A district wants to stop tunneling all staff traffic just to reach a file server.
- Publish the file share through an access proxy with SSO and device posture.
- Remove
10.0.0.0/8from the staff VPN profile; add only the print server. - Measure: tickets, latency, and whether anyone notices.
- If the legacy client cannot work through a proxy, keep that one route and document why.
The outcome is a smaller tunnel, not no tunnel. That is a success.
What breaks in production
- Assuming the proxy handles non-HTTP protocols. SMB, RDP, and custom ports need different products or a tunnel.
- No device posture, so any device with a valid login gets in.
- IdP as a single point of failure, with no break-glass path.
- Policy sprawl, where every app has bespoke rules nobody reviews.
- Declaring "zero trust" while the VPN still routes 10.0.0.0/8. The label changed; the risk did not.
Checklist
- Every user-facing application is inventoried and classified.
- At least one app is behind identity-aware access, in production.
- The VPN's routed prefixes shrink as apps move.
- Device posture is part of at least one policy.
- A break-glass access path exists and has been tested.
- Infrastructure access remains on a tunnel or jump host, deliberately.
Next
That closes the VPN series. The remaining series are WAN/SD-WAN, QoS, Physical Layer, and Network Programmability.